mediumMultiple Choice

CISA Practice Question: Based on the exhibit, what is the most likely…

Exhibit

Refer to the exhibit.

Audit Finding Report Excerpt:

Finding ID: F-001
Control: User Account Management
Observation: Review of Active Directory logs from 01-Mar-2024 to 07-Mar-2024 revealed that the default administrator account (Administrator) was used to perform 45% of all privileged actions. No evidence of secondary approval or time-based restrictions.

Configuration snippet from domain controller:

Set-ADUser -Identity Administrator -PasswordNeverExpires $true
Set-ADUser -Identity Administrator -CannotChangePassword $true

Audit Recommendation: Implement a privileged access management (PAM) solution and enforce use of individual privileged accounts.

Based on the exhibit, what is the most likely control weakness that allowed this condition?

⚠ Common exam trap

Many exam-takers confuse 'shared accounts' with 'default accounts' (Option C) or 'weak passwords' (Option A), but the exhibit's key indicator is multiple users logging in with the same non-default privileged account, which directly points to a lack of individual accountability.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Lack of individual accountability for privileged actions

The exhibit shows that multiple users are sharing a single privileged account (e.g., 'root' or 'admin') to perform administrative actions. Without unique user IDs for each administrator, it is impossible to map specific actions (e.g., a 'sudo' command or a configuration change) back to an individual. This lack of individual accountability is the core control weakness, as it violates the audit principle of non-repudiation and prevents effective forensic investigation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Weak password complexity requirements
Why it's wrong here
Password complexity governs credential strength, not the account, access or configuration condition depicted in the exhibit. It is tempting because weak passwords commonly enable unauthorised access, and strengthening complexity policy would be the right remediation where the exhibit showed brute-force or credential-stuffing compromise.
✓
Lack of individual accountability for privileged actions
Why this is correct
Shared privileged accounts let multiple administrators act under one identity, so audit logs cannot attribute a specific change to a named person. This directly satisfies the stem's condition: the exhibit shows activity that cannot be traced to an individual, defeating non-repudiation and least-privilege monitoring over privileged actions.
✗
Failure to disable the default administrator account
Why it's wrong here
The exhibit shows a condition unrelated to a lingering default administrator account, so disabling that account would not address the observed weakness. It is tempting because default accounts are a classic exposure, and disabling them would be correct where the exhibit showed an unchanged default credential granting privileged access.
✗
Inadequate segregation of duties between IT and security teams
Why it's wrong here
Segregation of duties concerns conflicting responsibilities between roles, whereas the exhibit's condition stems from a specific account or configuration setting. It is tempting because poor role separation genuinely enables privileged misuse, and it would be correct where the exhibit showed one person both administering and auditing the same system.

Go deeper

CISA Practice Question: Based on the exhibit, what is the most likely…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question